The vulnerability CVE-2026-22496 affects AncoraThemes Hypnotherapy plugin for WordPress up to version 1.2.10. It arises from improper validation or control of filenames used in PHP include or require statements, enabling local file inclusion. This can allow an attacker to include arbitrary files from the local filesystem, potentially leading to code execution, data disclosure, or denial of service. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently referenced, and the vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the server hosting the vulnerable plugin. This may lead to full compromise of the web application, disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Monitor official AncoraThemes communications for updates and apply patches promptly once available.